I found a scenario that would reliably mmap anonymous memory from a page range at the end of the bitmap. When the memory was munmap-ed , the index calculated on the patched line exceeded the size of _bitmap by 1. Interestingly, I could only reproduce this on 1 CPU instances (in EC2, no less) and it would cause the whole VM to hang when hit, e.g. no crash or panic.
Timmons From: OSv Gopher <[email protected]> on behalf of Nadav Har'El <[email protected]> Date: Sunday, January 14, 2018 at 4:59 AM To: Timmons Player <[email protected]>, Paweł Dziepak <[email protected]> Cc: OSv Gopher <[email protected]> Subject: Re: [PATCH] memory: fix off by 1 error in page_range_allocator On Fri, Jan 12, 2018 at 8:23 PM, Timmons C. Player <[email protected]<mailto:[email protected]>> wrote: The page_range_allocator free() method neglected to subtract 1 from the index when checking the end of the page range in the _bitmap. Fix the calculation. Note: with this change, the end index calculated by free() now matches the end index calculated in set_bits(). I'll commit because it looks reasonable, but I'm not sure I appreciate all the finer details of this code so Pawel, can you please review this one-line patch? Timmons, how did you see / reproduce this bug? Signed-off-by: Timmons C. Player <[email protected]<mailto:[email protected]>> --- core/mempool.cc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/core/mempool.cc b/core/mempool.cc index 569a0ac..e0d0867 100644 --- a/core/mempool.cc +++ b/core/mempool.cc @@ -767,7 +767,7 @@ void page_range_allocator::free(page_range* pr) pr2->size += pr->size; pr = pr2; } - if (_bitmap[get_bitmap_idx(*pr) + pr->size / page_size]) { + if (_bitmap[get_bitmap_idx(*pr) + pr->size / page_size - 1]) { auto pr2 = static_cast<page_range*>(static_cast<void*>(pr) + pr->size); remove(*pr2); pr->size += pr2->size; -- 2.7.4 -- You received this message because you are subscribed to the Google Groups "OSv Development" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]<mailto:osv-dev%[email protected]>. For more options, visit https://groups.google.com/d/optout. -- You received this message because you are subscribed to the Google Groups "OSv Development" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]<mailto:[email protected]>. For more options, visit https://groups.google.com/d/optout. Spirent Communications e-mail confidentiality. ------------------------------------------------------------------------ This e-mail contains confidential and / or privileged information belonging to Spirent Communications plc, its affiliates and / or subsidiaries. If you are not the intended recipient, you are hereby notified that any disclosure, copying, distribution and / or the taking of any action based upon reliance on the contents of this transmission is strictly forbidden. If you have received this message in error please notify the sender by return e-mail and delete it from your system. Spirent Communications plc Northwood Park, Gatwick Road, Crawley, West Sussex, RH10 9XN, United Kingdom. Tel No. +44 (0) 1293 767676 Fax No. +44 (0) 1293 767677 Registered in England Number 470893 Registered at Northwood Park, Gatwick Road, Crawley, West Sussex, RH10 9XN, United Kingdom. Or if within the US, Spirent Communications, 27349 Agoura Road, Calabasas, CA, 91301, USA. Tel No. 1-818-676- 2300 -- You received this message because you are subscribed to the Google Groups "OSv Development" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
